Loading vulnerability…
Arbitrary File Deletion via Path Traversal in Chamilo LMS savescores.php
CVE-2026-31939 is a path traversal vulnerability in Chamilo LMS affecting versions prior to 1.11.38. The flaw is present in main/exercise/savescores.php, where user-controlled input from $_REQUEST['test'] is concatenated directly into a filesystem path without canonicalization or traversal validation. An authenticated attacker can supply traversal sequences to escape the intended directory and target arbitrary files for deletion. The issue is described as leading to arbitrary file deletion rather than file read or code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary file deletion on the underlying server with the privileges of the web application. This can compromise integrity by removing application, configuration, course, or other reachable files, and can also affect availability by deleting files required for normal operation. The provided CVSS context also indicates limited confidentiality impact, but the primary documented consequence is unauthorized deletion of arbitrary files.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to the vulnerable functionality to only trusted authenticated users, apply server-side validation to reject path traversal sequences in the test parameter, and harden filesystem permissions so the web application account cannot delete sensitive files outside the intended working directory. Additional compensating controls include monitoring for suspicious requests containing traversal patterns and limiting the application's write/delete permissions to the minimum necessary.
Patch, then assume compromise.
Upgrade Chamilo LMS to version 1.11.38 or later, which fixes the vulnerability. The fix is referenced in commit 4dddcc19d36119da27b7c49eb84a035800abae78 and in the Chamilo LMS 1.11.38 release. Remediation should ensure that user-supplied path components are not concatenated directly into filesystem paths and that canonicalization and strict traversal checks are enforced before any filesystem operation is performed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.